chore(deploy): non-root image, reproducible builds, private database

- Dockerfile: Go 1.26, npm ci, go mod verify, non-root user, alpine 3.22.
- Compose: Postgres no longer published on the host, password and new
  security settings read from .env, GOMEMLIMIT.
- README: document new environment variables and reading shortcuts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,32 +1,33 @@
 # Multi-stage Dockerfile for FlowReader
 
 # Step 1: Build the React Frontend
-FROM node:20-alpine AS web-builder
+FROM node:22-alpine AS web-builder
 WORKDIR /app/web
 COPY web/package*.json ./
-RUN npm install
+# Reproducible install from the lockfile
+RUN npm ci --no-audit --no-fund
 COPY web/ ./
 RUN npm run build
 
 # Step 2: Build the Go Backend
-FROM golang:1.24-alpine AS builder
+FROM golang:1.26-alpine AS builder
 WORKDIR /app
-COPY . .
-RUN go mod tidy
-RUN go mod download
-# Copy the built frontend from Step 1
-COPY --from=web-builder /app/web/dist ./web/dist
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /server ./cmd/server
+COPY go.mod go.sum ./
+RUN go mod download && go mod verify
+COPY cmd/ ./cmd/
+COPY internal/ ./internal/
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-w -s" -o /server ./cmd/server
 
 # Step 3: Final Production Image
-FROM alpine:3.19
+FROM alpine:3.22
 WORKDIR /app
-RUN apk add --no-cache wget ca-certificates
+RUN apk add --no-cache wget ca-certificates tzdata \
+    && adduser -D -H -u 10001 flowreader
 COPY --from=builder /server /app/server
-# Copy the static files for the Go server to serve
-COPY --from=builder /app/web/dist /app/web/dist
-# Copy migration files for auto-migration
-COPY --from=builder /app/migrations /app/migrations
+# Static frontend and migrations (read-only for the app user)
+COPY --from=web-builder /app/web/dist /app/web/dist
+COPY migrations /app/migrations
 
+USER flowreader
 EXPOSE 8080
 CMD ["/app/server"]